FROM postgres:17

ARG SOURCE_BRANCH=main

ENV SOURCE_BRANCH=${SOURCE_BRANCH} \
    SOURCE_REPOSITORY=CaPaCaptain/PostgreSQL_general_HF \
    POSTGRES_USER=admin \
    POSTGRES_DB=appdb \
    PGDATA=/home/user/pgdata \
    DATA_DIR=/data \
    BACKUP_DIR=/data/backups \
    USER_FILE_DIR=/data/files \
    EXPORT_DIR=/data/exports \
    GENERATED_DIR=/data/generated \
    BACKUP_INTERVAL_SECONDS=3600 \
    ADMINER_VERSION=4.8.1 \
    PATH=/usr/lib/postgresql/17/bin:${PATH}

RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    curl \
    ca-certificates \
    coreutils \
    php-cli \
    php-pgsql \
    php-mysql \
    php-sqlite3 \
    python3 \
    python3-pip \
    procps \
    && rm -rf /var/lib/apt/lists/*

RUN curl -L -o /adminer.php \
    https://github.com/vrana/adminer/releases/download/v${ADMINER_VERSION}/adminer-${ADMINER_VERSION}.php

WORKDIR /bootstrap

# This Space keeps only README.md and this Dockerfile.
# At every container start, fetch the private GitHub repository root into /app,
# remove repository-only files, validate the API routes, and launch the service.
# Use a non-login shell so /etc/profile cannot replace the PostgreSQL image PATH.
CMD ["bash", "-c", "set -euo pipefail; \
  : \"${GITHUB_TOKEN:?GITHUB_TOKEN is required as a Hugging Face Space Secret}\"; \
  : \"${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required as a Hugging Face Space Secret}\"; \
  TOKEN=\"${GITHUB_TOKEN}\"; \
  AUTH=\"$(printf 'x-access-token:%s' \"${TOKEN}\" | base64 | tr -d '\\n')\"; \
  rm -rf /tmp/postgresql-general /app; \
  git -c http.extraHeader=\"Authorization: Basic ${AUTH}\" clone \
    --depth 1 \
    --branch \"${SOURCE_BRANCH}\" \
    \"https://github.com/${SOURCE_REPOSITORY}.git\" \
    /tmp/postgresql-general; \
  mkdir -p /app; \
  cp -a /tmp/postgresql-general/. /app/; \
  rm -rf /tmp/postgresql-general /app/.git /app/HF_files /app/docs; \
  unset GITHUB_TOKEN TOKEN AUTH; \
  python3 -m pip install --break-system-packages --no-cache-dir -r /app/requirements.txt; \
  chmod +x /app/start.sh; \
  python3 -m compileall -q /app; \
  cd /app; \
  python3 -c \"from platform_app.main import app; paths=set(app.openapi().get('paths', {})); required={'/api/health','/admin/projects','/api/flowtrace','/api/flowtrace-portfolio','/api/openclaw/memories','/api/files','/api/rss/articles'}; missing=required-paths; assert not missing, f'missing routes: {sorted(missing)}'; print(f'Validated {len(paths)} API routes')\"; \
  exec /app/start.sh"]

EXPOSE 5432
EXPOSE 7860